Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

hillbilly1980 writes "Internet Week has published a counter article in response to the number of anti-monoculture security papers recently published. Unfortunately the author starts out by writing off the other papers as simply anti-Microsoft, unfortunate because his paper never gets past being more then just pro-Microsoft. One of his suggestions to secure your enterprise... turn off port 80." Probably the best thing to do to prevent disinformation from entering your company is to block articles by Rob Enderle. Update: 10/11 00:54 GMT by M: Note for the record that the original version of the article referred to blocking port 80; the article has now been edited to refer to port 135.

The last time one of Rob Enderle's stories hit Slashdot, I went and did some googling around. An hour later, I had absolutely no evidence that the set of analysts comprising the Enderle group was any larger than the set composing Rob Enderle himself.

He probably has a stuffed penguin as a technical advisor, and I'd also bet that his technical advisor frequently gets pins stuck in him.

Or you could just make sure everything is off. I don't know how much more simple you can get. Of course, you do need a little bit of education to know how to tell that you really do have everything off, but it's still a heck of a lot simpler than learning assembler.

Or you could just make sure everything is off. I don't know how much more simple you can get. Of course, you do need a little bit of education to know how to tell that you really do have everything off, but it's still a heck of a lot simpler than learning assembler.

Great idea. Let me make sure everything is off
in my lab.
Let me also
ask management of my institute
to file for bankruptcy while I am at it.
I am sure they will thank me for making our network absolutely safe.

You mention quite a few very important but frequently underestimated issues here. The network where I work is constantly being monitored and we know that firewalls and IDSs need to work both ways. I think that the prosecution one of our workers who was downloading pornography using our network (the poor bastard thought des encrypted icmp echo reply payload was a good "covert channel" -- not when I am in charge) will face in few weeks pretty much speaks for itself.

> It may be funny, but sadly some people do really think that firewalling port 80 (or 8080, or 21, or 20, or 22, or 443 -- et cetera, ad nonsensum) is the answer indeed. Some people may be surprised (not Slashdot readers though, mind you) but there simply is no simple answer. There is no working snake oil. The buzzword of the week alone will not save you. What are my answers then? Simple. Read Security Focus. Read Crypto-Gram. Read Phrack. Read the underground IRC discussions. Read encrypted Usenet posts. Read the articles posted on Freenet. Read the books for god's sake! Read about systems. Read about networking protocols. Read about cryptography. Read about cryptanalysis. Employ honeypots in every network. Learn C. Learn Assembly (Intel as well as AT&T syntax, for different CPU architectures). Learn executable binary formats. Learn how to see polymorphic shellcodes in network packets hex dump, just looking at tcpdump output scroling on your terminal. Learn how to speak different protocols (http, smtp, pop3, etc.) with netcat, then making your own tcp packets, then your own hand-made ip packets, then ethernet, ppp and slip. Learn. Read. Then learn some more. Read. Read. Read. And learn the one most important thing: security is not easy. When everything fails, you are on your own.

Great idea! After I get done with that, I think I'll teach the users the difference between real error messages and banner ads.....